# Aster Mail privacy rating

Email service from Aster Communications Inc. in the United States, with servers in Germany. Mail between Aster users is end-to-end encrypted with a hybrid post-quantum key exchange. Free and paid plans, no ads in the service.

## Summary

Aster Mail scores 62 out of 100 (grade C) on the email providers criteria. It meets 9 of 20 criteria: transparency report, tells users about requests, TLS configuration, security headers, modern web standards, end-to-end encryption, encrypted mailbox storage, custom domains and email security standards. It partly meets open source, no trackers or telemetry, no ads or data sales, open protocols, sign up without personal data and mail transport security. It does not meet independent audit, IMAP support, POP3 support and Sender Rewriting Scheme. Still needing evidence: ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+, Mozilla HTTP Observatory grade A+, Internet.nl website score 95% and Internet.nl email score 90%.

- Website: https://astermail.org
- Source code: https://github.com/Aster-Privacy/Aster-Mail
- License: AGPL-3.0
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Android, Windows, macOS, Linux
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: C (62/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The web, desktop and Android apps, Aster Bridge and the aster-crypto library are open source under AGPL-3.0. The server is not. | https://github.com/Aster-Privacy/Aster-Mail/blob/main/LICENSE |
| No trackers or telemetry | Partial | The website loads no third-party trackers or analytics. Sign-ups from Reddit ads are reported to Reddit, and the apps send error reports without an identifier by default. | https://astermail.org/privacy |
| No ads or data sales | Partial | Funded by paid plans, with no ads in the service. Sign-ups from Aster's own Reddit ads are reported to Reddit through its Conversions API. | https://astermail.org/privacy |
| Independent audit | No | No independent audit is published. The transparency page says an audit is underway. | https://astermail.org/transparency |
| Transparency report | Yes | Publishes counts of legal requests received, accepted, denied and contested, with a signed warrant canary. | https://astermail.org/transparency |
| Tells users about requests | Yes | Users are notified of legal requests when the law does not forbid it. | https://astermail.org/privacy |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=astermail.org&hideResults=on |
| Security headers | Yes | Grade A+ (135/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=astermail.org |
| Modern web standards | Yes | Score 95% | https://batch.internet.nl/site/astermail.org/22660213/ |
| End-to-end encryption | Yes | Mail between Aster users is always end-to-end encrypted, including subject lines. OpenPGP or password-protected mail is available for other recipients. | https://astermail.org/help |
| Encrypted mailbox storage | Yes | Stored mail, including mail from other providers, is encrypted to the user's key. Private keys are stored encrypted with a key derived from the password. | https://astermail.org/blog/how-aster-encrypts-your-email/ |
| Open protocols | Partial | IMAP, POP3 and SMTP need the Aster Bridge app and the Star plan or higher. | https://astermail.org/bridge/docs |
| Custom domains | Yes | One custom domain on the free plan, and more on paid plans. | https://astermail.org/pricing |
| Sign up without personal data | Partial | No phone number or recovery email is needed for a first account. A recovery email is required to create additional accounts. | https://github.com/Aster-Privacy/Aster-Mail/blob/main/src/lib/i18n/translations/en.ts |
| Email security standards | Yes | Score 90% | https://batch.internet.nl/mail/astermail.org/22855412/ |
| IMAP support | No | Not offered. |  |
| POP3 support | No | Not offered. |  |
| SMTP submission | Not tested yet | Could not test: No server found (set a host in the rating file or publish RFC 6186 SRV records) |  |
| Mail transport security | Partial | Passes: SPF, DMARC reject, TLS-RPT, DNSSEC, DANE all. Missing: MTA-STS invalid. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | Unknown |  |  |

Source: https://privacyratings.com/email-providers/aster-mail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/aster-mail.md